@co0ontty/wand 0.3.0 → 0.4.0

package/dist/server.js

@@ -1,13 +1,17 @@
 import express from "express";
 import { readdir, readFile, stat } from "node:fs/promises";
+import { existsSync } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import path from "node:path";
 import process from "node:process";
-import { WebSocketServer, WebSocket } from "ws";
+import { WebSocketServer } from "ws";
 const execAsync = promisify(exec);
+const SERVER_MODULE_DIR = path.dirname(new URL(import.meta.url).pathname);
+const RUNTIME_ROOT_DIR = path.resolve(SERVER_MODULE_DIR, "..");
+import { ensureAvatarSeed, getAvatarSvg } from "./avatar.js";
 import { createSession, revokeSession, setAuthStorage, validateSession } from "./auth.js";
 import { ensureCertificates } from "./cert.js";
 import { isExecutionMode, resolveConfigDir } from "./config.js";
@@ -15,6 +19,11 @@ import { ProcessManager, SessionInputError } from "./process-manager.js";
 import { resolveDatabasePath, WandStorage } from "./storage.js";
 import { renderApp } from "./web-ui/index.js";
 import { parseMessages } from "./message-parser.js";
+import { generatePwaManifest, generateServiceWorker } from "./pwa.js";
+import { WsBroadcastManager } from "./ws-broadcast.js";
+import { checkRateLimit, recordFailedLogin, resetRateLimit } from "./middleware/rate-limit.js";
+import { isPathWithinBase, isBlockedFolderPath, normalizeFolderPath } from "./middleware/path-safety.js";
+// ── Error helpers ──
 function getErrorMessage(error, fallback) {
     return error instanceof Error ? error.message : fallback;
 }
@@ -27,8 +36,8 @@ function getInputErrorResponse(error, sessionId) {
                 error: error.message,
                 errorCode: error.code,
                 sessionId,
-                sessionStatus: error.sessionStatus ?? null
-            }
+                sessionStatus: error.sessionStatus ?? null,
+            },
         };
     }
     return {
@@ -37,37 +46,17 @@ function getInputErrorResponse(error, sessionId) {
             error: getErrorMessage(error, "会话已结束，请启动新会话。"),
             errorCode: "INPUT_SEND_FAILED",
             sessionId,
-            sessionStatus: null
-        }
+            sessionStatus: null,
+        },
     };
 }
 function getInputDebugMeta(error) {
     if (error instanceof Error) {
-        return {
-            name: error.name,
-            message: error.message,
-            stack: error.stack
-        };
+        return { name: error.name, message: error.message, stack: error.stack };
     }
     return { error };
 }
-function isPathWithinBase(targetPath, basePath) {
-    const relativePath = path.relative(basePath, targetPath);
-    return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));
-}
-const BLOCKED_FOLDER_PATHS = ["/etc", "/root", "/boot"];
-function isBlockedFolderPath(targetPath) {
-    return BLOCKED_FOLDER_PATHS.some((blockedPath) => {
-        const relativePath = path.relative(blockedPath, targetPath);
-        return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));
-    });
-}
-function normalizeFolderPath(inputPath) {
-    return path.resolve(inputPath);
-}
-/**
- * Check if a directory is inside a git repository
- */
+// ── Git helpers ──
 async function isGitRepo(dirPath) {
     try {
         await execAsync("git rev-parse --is-inside-work-tree", { cwd: dirPath });
@@ -77,9 +66,6 @@ async function isGitRepo(dirPath) {
         return false;
     }
 }
-/**
- * Get the git repository root directory
- */
 async function getGitRepoRoot(dirPath) {
     try {
         const { stdout } = await execAsync("git rev-parse --show-toplevel", { cwd: dirPath });
@@ -89,20 +75,12 @@ async function getGitRepoRoot(dirPath) {
         return null;
     }
 }
-/**
- * Get git status for all files in a directory
- * Returns a map of relative file paths to their git status
- */
 async function getGitStatusMap(gitRoot) {
     const statusMap = new Map();
     try {
-        // Get git status in porcelain format (stable for parsing)
-        // -uno: don't list untracked files (we'll get them separately)
         const { stdout: stagedStdout } = await execAsync("git status --porcelain -uno", { cwd: gitRoot });
-        // Get untracked files separately
         const { stdout: untrackedStdout } = await execAsync("git ls-files --others --exclude-standard", { cwd: gitRoot });
-        // Parse staged/unstaged changes
-        const lines = stagedStdout.split("\n").filter(line => line.trim());
+        const lines = stagedStdout.split("\n").filter((line) => line.trim());
         for (const line of lines) {
             if (line.length < 4)
                 continue;
@@ -112,7 +90,6 @@ async function getGitStatusMap(gitRoot) {
             if (!filePath)
                 continue;
             const status = {};
-            // Parse staged status
             if (stagedChar === "M")
                 status.staged = "modified";
             else if (stagedChar === "A")
@@ -121,15 +98,13 @@ async function getGitStatusMap(gitRoot) {
                 status.staged = "deleted";
             else if (stagedChar === "R")
                 status.staged = "renamed";
-            // Parse unstaged status
             if (unstagedChar === "M")
                 status.unstaged = "modified";
             else if (unstagedChar === "D")
                 status.unstaged = "deleted";
             statusMap.set(filePath, status);
         }
-        // Parse untracked files
-        const untrackedFiles = untrackedStdout.split("\n").filter(line => line.trim());
+        const untrackedFiles = untrackedStdout.split("\n").filter((line) => line.trim());
         for (const filePath of untrackedFiles) {
             const existing = statusMap.get(filePath);
             if (existing) {
@@ -141,72 +116,69 @@ async function getGitStatusMap(gitRoot) {
         }
         return statusMap;
     }
-    catch (error) {
-        // Git command failed, return empty map
+    catch {
         return statusMap;
     }
 }
-/**
- * Enrich file entries with git status
- */
 async function enrichWithGitStatus(items, dirPath) {
     try {
         const gitRoot = await getGitRepoRoot(dirPath);
-        if (!gitRoot) {
+        if (!gitRoot)
             return items;
-        }
         const gitStatusMap = await getGitStatusMap(gitRoot);
         return items.map((item) => {
-            // Get path relative to git root
             const relativePath = path.relative(gitRoot, item.path);
-            // Normalize path separators for cross-platform compatibility
-            const normalizedPath = relativePath.replace(/\\/g, '/');
+            const normalizedPath = relativePath.replace(/\\/g, "/");
             const gitStatus = gitStatusMap.get(normalizedPath);
-            return {
-                ...item,
-                gitStatus: gitStatus || undefined
-            };
+            return { ...item, gitStatus: gitStatus || undefined };
         });
     }
     catch {
         return items;
     }
 }
-// Simple in-memory rate limiter for login attempts
-const loginAttempts = new Map();
-const RATE_LIMIT_WINDOW = 15 * 60 * 1000; // 15 minutes
-const RATE_LIMIT_MAX = 10; // 10 attempts per window
-function checkRateLimit(ip) {
-    const now = Date.now();
-    const record = loginAttempts.get(ip);
-    if (!record || now > record.resetAt) {
-        return true;
-    }
-    return record.count < RATE_LIMIT_MAX;
-}
-function recordFailedLogin(ip) {
-    const now = Date.now();
-    const record = loginAttempts.get(ip);
-    if (!record || now > record.resetAt) {
-        loginAttempts.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW });
+// ── Auth helpers ──
+function requireAuth(req, res, next) {
+    if (!validateSession(readSessionCookie(req))) {
+        res.status(401).json({ error: "未授权，请先登录。" });
         return;
     }
-    record.count++;
+    next();
 }
-function resetRateLimit(ip) {
-    loginAttempts.delete(ip);
+function readSessionCookie(req) {
+    const cookie = req.headers.cookie;
+    if (!cookie)
+        return undefined;
+    const match = cookie.split(";").map((part) => part.trim()).find((part) => part.startsWith("wand_session="));
+    return match?.slice("wand_session=".length);
 }
-function cleanupRateLimiter() {
-    const now = Date.now();
-    for (const [ip, record] of loginAttempts.entries()) {
-        if (now > record.resetAt) {
-            loginAttempts.delete(ip);
-        }
+function normalizeMode(input, fallback) {
+    return isExecutionMode(input) ? input : fallback;
+}
+async function listPathSuggestions(input, fallbackCwd) {
+    const normalizedInput = input.trim();
+    const baseInput = normalizedInput || fallbackCwd;
+    const resolvedInput = path.resolve(process.cwd(), baseInput);
+    const endsWithSeparator = /[\\/]$/.test(normalizedInput);
+    let searchDir = resolvedInput;
+    let partialName = "";
+    if (!endsWithSeparator) {
+        searchDir = path.dirname(resolvedInput);
+        partialName = path.basename(resolvedInput);
     }
+    const entries = await readdir(searchDir, { withFileTypes: true });
+    return entries
+        .filter((entry) => entry.isDirectory())
+        .filter((entry) => !partialName || entry.name.toLowerCase().startsWith(partialName.toLowerCase()))
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .slice(0, 8)
+        .map((entry) => ({
+        path: path.join(searchDir, entry.name),
+        name: entry.name,
+        isDirectory: true,
+    }));
 }
-// Cleanup rate limiter every 5 minutes
-setInterval(cleanupRateLimiter, 5 * 60 * 1000);
-// Catch-all for unexpected startup errors
+// ── Startup error handling ──
 process.on("uncaughtException", (err) => {
     wandError("服务器异常", err.message, "请检查配置是否正确，或尝试重启服务。");
     process.exit(1);
@@ -215,7 +187,6 @@ process.on("unhandledRejection", (reason) => {
     const msg = reason instanceof Error ? reason.message : String(reason);
     wandError("未处理的异步错误", msg);
 });
-// ── Friendly error / warn / info helpers ──────────────────────────────────
 function wandError(label, message, suggestion) {
     process.stderr.write(`\n✗ [wand] ${label}：${message}\n`);
     if (suggestion)
@@ -227,164 +198,96 @@ function wandWarn(message, hint) {
     if (hint)
         process.stderr.write(`  提示：${hint}\n`);
 }
-function wandInfo(message) {
-    process.stdout.write(`ℹ️  [wand] ${message}\n`);
+function parseStoredPathList(raw) {
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+const HIDDEN_CLAUDE_SESSIONS_KEY = "hidden_claude_sessions";
+function getHiddenClaudeSessionIds(storage) {
+    return new Set(parseStoredPathList(storage.getConfigValue(HIDDEN_CLAUDE_SESSIONS_KEY)));
+}
+function saveHiddenClaudeSessionIds(storage, hidden) {
+    storage.setConfigValue(HIDDEN_CLAUDE_SESSIONS_KEY, JSON.stringify(Array.from(hidden)));
 }
+const MAX_RECENT_PATHS = 10;
+// ── File language detection ──
+function getLanguageFromExt(ext, filePath) {
+    const map = {
+        ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx",
+        ".json": "json", ".html": "html", ".htm": "html",
+        ".css": "css", ".scss": "scss", ".less": "less",
+        ".py": "python", ".rb": "ruby", ".go": "go", ".rs": "rust",
+        ".java": "java", ".c": "c", ".cpp": "cpp", ".h": "c", ".hpp": "cpp",
+        ".cs": "csharp", ".swift": "swift", ".kt": "kotlin", ".scala": "scala",
+        ".php": "php", ".sh": "bash", ".bash": "bash", ".zsh": "bash",
+        ".yaml": "yaml", ".yml": "yaml", ".toml": "toml", ".ini": "ini",
+        ".xml": "xml", ".sql": "sql", ".graphql": "graphql",
+        ".md": "markdown", ".markdown": "markdown", ".mdown": "markdown",
+        ".mkd": "markdown", ".mkdn": "markdown",
+        ".dockerfile": "dockerfile", ".gitignore": "plaintext",
+        ".diff": "diff", ".patch": "diff", ".proto": "protobuf",
+        ".env": "bash", ".editorconfig": "ini",
+        ".mdx": "markdown", ".vue": "html", ".svelte": "html",
+    };
+    const baseName = path.basename(filePath).toLowerCase();
+    if (baseName === "dockerfile")
+        return "dockerfile";
+    if (baseName === ".gitignore")
+        return "plaintext";
+    return map[ext] || "plaintext";
+}
+// ── Main server ──
 export async function startServer(config, configPath) {
     const app = express();
     const storage = new WandStorage(resolveDatabasePath(configPath));
     setAuthStorage(storage);
-    const processes = new ProcessManager(config, storage, resolveConfigDir(configPath));
-    const useHttps = config.https !== false; // Default to true
+    const configDir = resolveConfigDir(configPath);
+    const avatarSeed = await ensureAvatarSeed(configDir);
+    const processes = new ProcessManager(config, storage, configDir);
+    const useHttps = config.https === true;
     const protocol = useHttps ? "https" : "http";
+    const nodeModulesDir = path.join(RUNTIME_ROOT_DIR, "node_modules");
     app.use(express.json({ limit: "1mb" }));
-    app.use("/vendor/xterm", express.static(path.resolve(process.cwd(), "node_modules/xterm")));
-    app.use("/vendor/xterm-addon-fit", express.static(path.resolve(process.cwd(), "node_modules/@xterm/addon-fit")));
+    app.use("/vendor/xterm", express.static(path.join(nodeModulesDir, "xterm")));
+    app.use("/vendor/xterm-addon-fit", express.static(path.join(nodeModulesDir, "@xterm", "addon-fit")));
+    // ── Web UI and PWA endpoints ──
     app.get("/", (_req, res) => {
+        res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
         res.type("html").send(renderApp(configPath));
     });
-    // PWA manifest
     app.get("/manifest.json", (_req, res) => {
-        res.type("json").send(JSON.stringify({
-            id: "/",
-            scope: "/",
-            name: "Wand Console",
-            short_name: "Wand",
-            description: "Local CLI Console for Vibe Coding",
-            start_url: "/",
-            display: "standalone",
-            display_override: ["standalone", "minimal-ui", "browser"],
-            background_color: "#f6f1e8",
-            theme_color: "#c5653d",
-            orientation: "any",
-            icons: [
-                { src: "/icon.svg", sizes: "any", type: "image/svg+xml", purpose: "any maskable" },
-                { src: "/icon-192.png", sizes: "192x192", type: "image/png", purpose: "any" },
-                { src: "/icon-512.png", sizes: "512x512", type: "image/png", purpose: "any" }
-            ],
-            categories: ["developer tools", "productivity"],
-            shortcuts: [
-                { name: "New Session", short_name: "New", url: "/?action=new", description: "Start a new CLI session" }
-            ],
-            // iOS Safari specific
-            ios: {
-                statusBarStyle: "black-translucent"
-            },
-            // Android Chrome specific
-            share_target: {
-                action: "/",
-                method: "GET",
-                params: {
-                    text: "q",
-                    url: "url"
-                }
-            }
-        }));
+        res.setHeader("Content-Type", "application/manifest+json");
+        res.send(generatePwaManifest());
     });
-    const iconSvg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 192">
-    <defs><linearGradient id="g" x1="0%" y1="0%" x2="100%" y2="100%">
-      <stop offset="0%" style="stop-color:#d77a52"/>
-      <stop offset="100%" style="stop-color:#a95130"/>
-    </linearGradient></defs>
-    <rect width="192" height="192" rx="38" fill="url(#g)"/>
-    <text x="96" y="128" text-anchor="middle" font-family="system-ui,sans-serif" font-size="88" font-weight="700" fill="white">W</text>
-  </svg>`;
     app.get("/icon.svg", (_req, res) => {
-        res.type("svg").send(iconSvg);
+        res.type("image/svg+xml").send(getAvatarSvg(avatarSeed, 192));
     });
+    const iconsDir = path.resolve(existsSync(path.join(SERVER_MODULE_DIR, "web-ui", "content"))
+        ? path.join(SERVER_MODULE_DIR, "web-ui", "content")
+        : path.join(RUNTIME_ROOT_DIR, "src", "web-ui", "content"));
     app.get("/icon-192.png", (_req, res) => {
-        res.redirect(302, "/icon.svg");
+        res.type("image/svg+xml").send(getAvatarSvg(avatarSeed, 192));
     });
     app.get("/icon-512.png", (_req, res) => {
-        res.redirect(302, "/icon.svg");
+        res.type("image/svg+xml").send(getAvatarSvg(avatarSeed, 512));
     });
-    // Service Worker for offline support
     app.get("/sw.js", (_req, res) => {
-        res.type("javascript").send(`
-const STATIC_CACHE = 'wand-static-v2';
-const RUNTIME_CACHE = 'wand-runtime-v2';
-const APP_SHELL = '/';
-const STATIC_ASSETS = [
-  APP_SHELL,
-  '/manifest.json',
-  '/icon.svg',
-  '/vendor/xterm/css/xterm.css',
-  '/vendor/xterm/lib/xterm.js',
-  '/vendor/xterm-addon-fit/lib/addon-fit.js'
-];
-
-self.addEventListener('install', (event) => {
-  event.waitUntil(caches.open(STATIC_CACHE).then((cache) => cache.addAll(STATIC_ASSETS)));
-  self.skipWaiting();
-});
-
-self.addEventListener('activate', (event) => {
-  event.waitUntil(
-    caches.keys().then((keys) => Promise.all(
-      keys
-        .filter((key) => key !== STATIC_CACHE && key !== RUNTIME_CACHE)
-        .map((key) => caches.delete(key))
-    ))
-  );
-  self.clients.claim();
-});
-
-async function cacheFirst(request) {
-  const cached = await caches.match(request);
-  if (cached) return cached;
-
-  const response = await fetch(request);
-  if (response.ok && request.method === 'GET') {
-    const clone = response.clone();
-    const cache = await caches.open(RUNTIME_CACHE);
-    cache.put(request, clone);
-  }
-  return response;
-}
-
-self.addEventListener('fetch', (event) => {
-  const request = event.request;
-  const url = new URL(request.url);
-
-  if (request.method !== 'GET') {
-    return;
-  }
-
-  if (url.pathname.startsWith('/api/')) {
-    event.respondWith(
-      fetch(request).catch(() => new Response(JSON.stringify({ error: 'Offline' }), {
-        status: 503,
-        headers: { 'Content-Type': 'application/json' }
-      }))
-    );
-    return;
-  }
-
-  if (request.mode === 'navigate') {
-    event.respondWith(
-      fetch(request)
-        .then((response) => {
-          const clone = response.clone();
-          caches.open(RUNTIME_CACHE).then((cache) => cache.put(APP_SHELL, clone));
-          return response;
-        })
-        .catch(async () => (await caches.match(APP_SHELL)) || Response.error())
-    );
-    return;
-  }
-
-  event.respondWith(
-    cacheFirst(request).catch(async () => {
-      const cached = await caches.match(request);
-      return cached || (await caches.match(APP_SHELL)) || Response.error();
-    })
-  );
-});
-`);
+        res.setHeader("Content-Type", "application/javascript");
+        res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+        res.setHeader("Service-Worker-Allowed", "/");
+        res.send(generateServiceWorker());
     });
     app.get("/offline", (_req, res) => {
         res.type("html").send(renderApp(configPath));
     });
+    // ── Auth routes ──
     app.post("/api/login", (req, res) => {
         const clientIp = req.ip || req.socket.remoteAddress || "unknown";
         if (!checkRateLimit(clientIp)) {
@@ -392,7 +295,6 @@ self.addEventListener('fetch', (event) => {
             return;
         }
         const { password } = req.body;
-        // Check password: prefer database password, fallback to config password
         const dbPassword = storage.getPassword();
         const effectivePassword = dbPassword ?? config.password;
         if (password !== effectivePassword) {
@@ -406,7 +308,7 @@ self.addEventListener('fetch', (event) => {
             httpOnly: true,
             sameSite: "strict",
             secure: useHttps,
-            maxAge: 1000 * 60 * 60 * 12
+            maxAge: 1000 * 60 * 60 * 12,
         });
         res.json({ ok: true });
     });
@@ -415,7 +317,6 @@ self.addEventListener('fetch', (event) => {
         res.clearCookie("wand_session");
         res.json({ ok: true });
     });
-    // Set password endpoint (requires auth)
     app.post("/api/set-password", requireAuth, (req, res) => {
         const { password } = req.body;
         if (!password || password.length < 6) {
@@ -426,18 +327,143 @@ self.addEventListener('fetch', (event) => {
         res.json({ ok: true });
     });
     app.use("/api", requireAuth);
+    // ── Config & Session info ──
     app.get("/api/config", (_req, res) => {
         res.json({
             host: config.host,
             port: config.port,
             defaultMode: config.defaultMode,
             defaultCwd: config.defaultCwd,
-            commandPresets: config.commandPresets
+            commandPresets: config.commandPresets,
         });
     });
     app.get("/api/sessions", (_req, res) => {
         res.json(processes.list());
     });
+    app.get("/api/claude-history", (_req, res) => {
+        try {
+            const sessions = processes.listClaudeHistorySessions();
+            const hidden = getHiddenClaudeSessionIds(storage);
+            const filtered = hidden.size > 0
+                ? sessions.filter((s) => !s.claudeSessionId || !hidden.has(s.claudeSessionId))
+                : sessions;
+            res.json(filtered);
+        }
+        catch (error) {
+            res.status(500).json({ error: getErrorMessage(error, "无法扫描 Claude 历史会话。") });
+        }
+    });
+    app.delete("/api/claude-history/:claudeSessionId", (req, res) => {
+        const claudeSessionId = req.params.claudeSessionId?.trim();
+        if (!claudeSessionId) {
+            res.status(400).json({ error: "会话 ID 不能为空。" });
+            return;
+        }
+        const hidden = getHiddenClaudeSessionIds(storage);
+        if (!hidden.has(claudeSessionId)) {
+            hidden.add(claudeSessionId);
+            saveHiddenClaudeSessionIds(storage, hidden);
+        }
+        res.json({ ok: true });
+    });
+    app.delete("/api/claude-history", (req, res) => {
+        const cwd = typeof req.query.cwd === "string" ? req.query.cwd.trim() : "";
+        if (!cwd) {
+            res.status(400).json({ error: "目录不能为空。" });
+            return;
+        }
+        try {
+            const sessions = processes.listClaudeHistorySessions();
+            const hidden = getHiddenClaudeSessionIds(storage);
+            let added = 0;
+            for (const session of sessions) {
+                if (!session.claudeSessionId || session.cwd !== cwd) {
+                    continue;
+                }
+                if (hidden.has(session.claudeSessionId)) {
+                    continue;
+                }
+                hidden.add(session.claudeSessionId);
+                added += 1;
+            }
+            if (added > 0) {
+                saveHiddenClaudeSessionIds(storage, hidden);
+            }
+            res.json({ ok: true, deleted: added });
+        }
+        catch (error) {
+            res.status(500).json({ error: getErrorMessage(error, "无法删除该目录下的历史会话。") });
+        }
+    });
+    app.post("/api/claude-history/batch-delete", express.json(), (req, res) => {
+        const claudeSessionIds = Array.isArray(req.body?.claudeSessionIds)
+            ? req.body.claudeSessionIds.filter((value) => typeof value === "string" && value.trim().length > 0)
+            : [];
+        if (claudeSessionIds.length === 0) {
+            res.status(400).json({ error: "至少提供一个历史会话 ID。" });
+            return;
+        }
+        try {
+            const hidden = getHiddenClaudeSessionIds(storage);
+            let added = 0;
+            for (const claudeSessionId of claudeSessionIds) {
+                if (hidden.has(claudeSessionId)) {
+                    continue;
+                }
+                hidden.add(claudeSessionId);
+                added += 1;
+            }
+            if (added > 0) {
+                saveHiddenClaudeSessionIds(storage, hidden);
+            }
+            res.json({ ok: true, deleted: added });
+        }
+        catch (error) {
+            res.status(500).json({ error: getErrorMessage(error, "无法批量删除历史会话。") });
+        }
+    });
+    app.post("/api/sessions/batch-delete", express.json(), (req, res) => {
+        const sessionIds = Array.isArray(req.body?.sessionIds)
+            ? req.body.sessionIds.filter((value) => typeof value === "string" && value.trim().length > 0)
+            : [];
+        if (sessionIds.length === 0) {
+            res.status(400).json({ error: "至少提供一个会话 ID。" });
+            return;
+        }
+        let deleted = 0;
+        const failed = [];
+        for (const sessionId of sessionIds) {
+            try {
+                processes.delete(sessionId);
+                deleted += 1;
+            }
+            catch {
+                failed.push(sessionId);
+            }
+        }
+        if (deleted === 0 && failed.length > 0) {
+            res.status(400).json({ error: "无法批量删除会话。", failed });
+            return;
+        }
+        res.json({ ok: true, deleted, failed });
+    });
+    app.get("/api/sessions/:id", (req, res) => {
+        const snapshot = processes.get(req.params.id);
+        if (!snapshot) {
+            res.status(404).json({ error: "未找到该会话，可能已被删除。" });
+            return;
+        }
+        if (req.query.format === "chat") {
+            const messages = snapshot.messages && snapshot.messages.length > 0
+                ? snapshot.messages
+                : parseMessages(snapshot.output);
+            res.json({ ...snapshot, messages });
+        }
+        else {
+            res.json(snapshot);
+        }
+    });
+    // ── Path suggestion ──
     app.get("/api/path-suggestions", async (req, res) => {
         const query = typeof req.query.q === "string" ? req.query.q : "";
         try {
@@ -448,11 +474,11 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "无法加载路径建议。") });
         }
     });
+    // ── File browsing ──
     app.get("/api/directory", async (req, res) => {
         const q = typeof req.query.q === "string" ? req.query.q : "";
         const includeGitStatus = req.query.gitStatus === "true";
         const targetPath = path.resolve(process.cwd(), q);
-        // Security check: ensure the resolved path is within the current working directory
         const allowedBase = process.cwd();
         if (!isPathWithinBase(targetPath, allowedBase)) {
             res.status(403).json({ error: "访问被拒绝：路径必须在项目目录内。" });
@@ -462,7 +488,6 @@ self.addEventListener('fetch', (event) => {
             const entries = await readdir(targetPath, { withFileTypes: true });
             let items = entries
                 .sort((a, b) => {
-                // Directories first, then alphabetically
                 if (a.isDirectory() && !b.isDirectory())
                     return -1;
                 if (!a.isDirectory() && b.isDirectory())
@@ -473,9 +498,8 @@ self.addEventListener('fetch', (event) => {
                 .map((entry) => ({
                 path: path.join(targetPath, entry.name),
                 name: entry.name,
-                type: entry.isDirectory() ? "dir" : "file"
+                type: entry.isDirectory() ? "dir" : "file",
             }));
-            // Enrich with git status if requested
             if (includeGitStatus) {
                 items = await enrichWithGitStatus(items, targetPath);
             }
@@ -485,8 +509,7 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "无法读取目录。可能原因：路径不存在或权限不足。") });
         }
     });
-    // File preview API - reads file contents with size limit
-    const MAX_FILE_SIZE = 512 * 1024; // 512KB limit
+    const MAX_FILE_SIZE = 512 * 1024;
     app.get("/api/file-preview", async (req, res) => {
         const filePath = typeof req.query.path === "string" ? req.query.path : "";
         if (!filePath) {
@@ -511,9 +534,7 @@ self.addEventListener('fetch', (event) => {
             }
             const ext = path.extname(filePath).toLowerCase();
             const previewableExts = [
-                // Markdown
                 ".md", ".markdown", ".mdown", ".mkd", ".mkdn",
-                // Code
                 ".ts", ".tsx", ".js", ".jsx", ".json", ".html", ".css", ".scss", ".less",
                 ".py", ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
                 ".cs", ".swift", ".kt", ".scala", ".php", ".sh", ".bash", ".zsh",
@@ -521,58 +542,23 @@ self.addEventListener('fetch', (event) => {
                 ".xml", ".sql", ".graphql", ".proto",
                 ".dockerfile", ".gitignore", ".env", ".editorconfig",
                 ".mdx", ".vue", ".svelte",
-                // Text
-                ".txt", ".log", ".diff", ".patch"
+                ".txt", ".log", ".diff", ".patch",
             ];
             const isText = previewableExts.includes(ext) ||
                 ext === "" ||
-                [".gitignore", "dockerfile", ".env.local", ".env.development"].some(e => filePath.toLowerCase().endsWith(e));
+                [".gitignore", "dockerfile", ".env.local", ".env.development"].some((e) => filePath.toLowerCase().endsWith(e));
             if (!isText) {
                 res.status(415).json({ error: "Unsupported file type", ext });
                 return;
             }
             const content = await readFile(resolvedPath, "utf-8");
             const lang = getLanguageFromExt(ext, filePath);
-            res.json({
-                path: resolvedPath,
-                name: path.basename(filePath),
-                ext,
-                lang,
-                content,
-                size: fileStat.size
-            });
+            res.json({ path: resolvedPath, name: path.basename(filePath), ext, lang, content, size: fileStat.size });
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "Failed to read file") });
         }
     });
-    // Helper to detect language from extension
-    function getLanguageFromExt(ext, filePath) {
-        const map = {
-            ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx",
-            ".json": "json", ".html": "html", ".htm": "html",
-            ".css": "css", ".scss": "scss", ".less": "less",
-            ".py": "python", ".rb": "ruby", ".go": "go", ".rs": "rust",
-            ".java": "java", ".c": "c", ".cpp": "cpp", ".h": "c", ".hpp": "cpp",
-            ".cs": "csharp", ".swift": "swift", ".kt": "kotlin", ".scala": "scala",
-            ".php": "php", ".sh": "bash", ".bash": "bash", ".zsh": "bash",
-            ".yaml": "yaml", ".yml": "yaml", ".toml": "toml", ".ini": "ini",
-            ".xml": "xml", ".sql": "sql", ".graphql": "graphql",
-            ".md": "markdown", ".markdown": "markdown", ".mdown": "markdown",
-            ".mkd": "markdown", ".mkdn": "markdown",
-            ".dockerfile": "dockerfile", ".gitignore": "plaintext",
-            ".diff": "diff", ".patch": "diff", ".proto": "protobuf",
-            ".env": "bash", ".editorconfig": "ini",
-            ".mdx": "markdown", ".vue": "html", ".svelte": "html"
-        };
-        const baseName = path.basename(filePath).toLowerCase();
-        if (baseName === "dockerfile")
-            return "dockerfile";
-        if (baseName === ".gitignore")
-            return "plaintext";
-        return map[ext] || "plaintext";
-    }
-    // Folder picker API - starts from /tmp by default, supports navigation
     app.get("/api/folders", async (req, res) => {
         const q = typeof req.query.q === "string" ? req.query.q : "/tmp";
         const targetPath = normalizeFolderPath(q);
@@ -583,38 +569,24 @@ self.addEventListener('fetch', (event) => {
         try {
             const entries = await readdir(targetPath, { withFileTypes: true });
             const items = [];
-            // Add parent directory navigation (..)
             const parentPath = path.dirname(targetPath);
             if (parentPath !== targetPath) {
-                items.push({
-                    path: parentPath,
-                    name: "..",
-                    type: "parent",
-                    isParent: true
-                });
+                items.push({ path: parentPath, name: "..", type: "parent", isParent: true });
             }
-            // Add subdirectories
             entries
                 .filter((entry) => entry.isDirectory())
                 .sort((a, b) => a.name.localeCompare(b.name))
                 .slice(0, 100)
                 .forEach((entry) => {
-                items.push({
-                    path: path.join(targetPath, entry.name),
-                    name: entry.name,
-                    type: "dir"
-                });
-            });
-            res.json({
-                currentPath: targetPath,
-                items: items
+                items.push({ path: path.join(targetPath, entry.name), name: entry.name, type: "dir" });
             });
+            res.json({ currentPath: targetPath, items });
         }
         catch (error) {
-            if (error.code === 'ENOENT') {
+            if (error.code === "ENOENT") {
                 res.status(404).json({ error: "路径不存在：" + q, currentPath: q, items: [] });
             }
-            else if (error.code === 'EACCES') {
+            else if (error.code === "EACCES") {
                 res.status(403).json({ error: "权限不足，无法访问：" + q, currentPath: q, items: [] });
             }
             else {
@@ -622,33 +594,19 @@ self.addEventListener('fetch', (event) => {
             }
         }
     });
-    // Quick paths API - returns common paths for quick access
-    app.get("/api/quick-paths", async (req, res) => {
-        const home = process.env.HOME || process.env.USERPROFILE || '/home';
-        const quickPaths = [
+    app.get("/api/quick-paths", async (_req, res) => {
+        const home = process.env.HOME || process.env.USERPROFILE || "/home";
+        res.json([
             { path: "/tmp", name: "临时目录", icon: "🗑️" },
             { path: home, name: "主目录", icon: "🏠" },
             { path: process.cwd(), name: "当前目录", icon: "📂" },
-            { path: "/", name: "根目录", icon: "📁" }
-        ];
-        res.json(quickPaths);
+            { path: "/", name: "根目录", icon: "📁" },
+        ]);
     });
-    function parseStoredPathList(raw) {
-        if (!raw) {
-            return [];
-        }
-        try {
-            const parsed = JSON.parse(raw);
-            return Array.isArray(parsed) ? parsed : [];
-        }
-        catch {
-            return [];
-        }
-    }
     app.get("/api/favorite-paths", (_req, res) => {
         const stored = storage.getConfigValue("favorite_paths");
         const favorites = parseStoredPathList(stored);
-        res.json(favorites.filter((favorite) => !isBlockedFolderPath(normalizeFolderPath(favorite.path))));
+        res.json(favorites.filter((f) => !isBlockedFolderPath(normalizeFolderPath(f.path))));
     });
     app.post("/api/favorite-paths", (req, res) => {
         const { path: favPath, name, icon } = req.body;
@@ -663,7 +621,6 @@ self.addEventListener('fetch', (event) => {
         }
         const stored = storage.getConfigValue("favorite_paths");
         const favorites = parseStoredPathList(stored);
-        // Check if already exists
         if (favorites.some((f) => normalizeFolderPath(f.path) === resolvedFavoritePath)) {
             res.status(400).json({ error: "该路径已在收藏列表中。" });
             return;
@@ -672,7 +629,7 @@ self.addEventListener('fetch', (event) => {
             path: resolvedFavoritePath,
             name: name || path.basename(resolvedFavoritePath),
             icon: icon || "⭐",
-            addedAt: new Date().toISOString()
+            addedAt: new Date().toISOString(),
         };
         favorites.push(newFavorite);
         storage.setConfigValue("favorite_paths", JSON.stringify(favorites));
@@ -695,7 +652,6 @@ self.addEventListener('fetch', (event) => {
         storage.setConfigValue("favorite_paths", JSON.stringify(favorites));
         res.json({ ok: true });
     });
-    const MAX_RECENT_PATHS = 10;
     app.get("/api/recent-paths", (_req, res) => {
         const stored = storage.getConfigValue("recent_paths");
         const recent = parseStoredPathList(stored);
@@ -714,21 +670,17 @@ self.addEventListener('fetch', (event) => {
         }
         const stored = storage.getConfigValue("recent_paths");
         let recent = parseStoredPathList(stored);
-        // Remove existing entry for this path (to update position)
         recent = recent.filter((r) => normalizeFolderPath(r.path) !== resolvedRecentPath);
-        // Add to front
         const newRecent = {
             path: resolvedRecentPath,
             name: path.basename(resolvedRecentPath),
-            lastUsedAt: new Date().toISOString()
+            lastUsedAt: new Date().toISOString(),
         };
         recent.unshift(newRecent);
-        // Keep only last N entries
         recent = recent.slice(0, MAX_RECENT_PATHS);
         storage.setConfigValue("recent_paths", JSON.stringify(recent));
         res.json(newRecent);
     });
-    // ============ Path Validation API ============
     app.get("/api/validate-path", async (req, res) => {
         const inputPath = typeof req.query.path === "string" ? req.query.path : "";
         if (!inputPath.trim()) {
@@ -741,17 +693,16 @@ self.addEventListener('fetch', (event) => {
                 res.json({ valid: false, error: "访问被拒绝：无法访问系统敏感目录。", resolvedPath });
                 return;
             }
-            const stats = await import("node:fs/promises").then(fs => fs.stat(resolvedPath));
+            const stats = await import("node:fs/promises").then((fs) => fs.stat(resolvedPath));
             if (!stats.isDirectory()) {
                 res.json({ valid: false, error: "路径不是目录", resolvedPath });
                 return;
             }
-            // Check read permission
             try {
                 await readdir(resolvedPath);
                 res.json({ valid: true, resolvedPath, name: path.basename(resolvedPath) });
             }
-            catch (permError) {
+            catch {
                 res.json({ valid: false, error: "没有读取权限", resolvedPath });
             }
         }
@@ -768,13 +719,11 @@ self.addEventListener('fetch', (event) => {
             }
         }
     });
-    // File search API - supports fuzzy matching across directory tree
     app.get("/api/file-search", async (req, res) => {
         const query = typeof req.query.q === "string" ? req.query.q : "";
         const cwd = typeof req.query.cwd === "string" ? req.query.cwd : process.cwd();
         const maxDepth = typeof req.query.depth === "string" ? parseInt(req.query.depth, 10) : 5;
         const maxResults = typeof req.query.limit === "string" ? parseInt(req.query.limit, 10) : 50;
-        // Security check: ensure cwd is within allowed base
         const allowedBase = process.cwd();
         const resolvedCwd = path.resolve(allowedBase, cwd);
         if (!isPathWithinBase(resolvedCwd, allowedBase)) {
@@ -788,7 +737,6 @@ self.addEventListener('fetch', (event) => {
         try {
             const results = [];
             const queryLower = query.toLowerCase();
-            // Recursive search function
             async function searchDir(dirPath, currentDepth) {
                 if (currentDepth > maxDepth || results.length >= maxResults)
                     return;
@@ -796,29 +744,25 @@ self.addEventListener('fetch', (event) => {
                 for (const entry of entries) {
                     if (results.length >= maxResults)
                         break;
-                    // Skip hidden files and node_modules
                     if (entry.name.startsWith(".") || entry.name === "node_modules")
                         continue;
                     const entryPath = path.join(dirPath, entry.name);
                     const nameLower = entry.name.toLowerCase();
-                    // Check if name matches query (fuzzy match)
                     const matchIndex = nameLower.indexOf(queryLower);
                     if (matchIndex !== -1) {
                         results.push({
                             path: entryPath,
                             name: entry.name,
                             type: entry.isDirectory() ? "dir" : "file",
-                            matchScore: matchIndex // Lower score = better match (appears earlier in name)
+                            matchScore: matchIndex,
                         });
                     }
-                    // Recurse into directories
                     if (entry.isDirectory()) {
                         await searchDir(entryPath, currentDepth + 1);
                     }
                 }
             }
             await searchDir(resolvedCwd, 0);
-            // Sort by match score (earlier match = better) and then alphabetically
             results.sort((a, b) => {
                 if (a.matchScore !== b.matchScore)
                     return a.matchScore - b.matchScore;
@@ -830,23 +774,7 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "搜索失败。可能原因：路径不存在或权限不足。") });
         }
     });
-    app.get("/api/sessions/:id", (req, res) => {
-        const snapshot = processes.get(req.params.id);
-        if (!snapshot) {
-            res.status(404).json({ error: "未找到该会话，可能已被删除。" });
-            return;
-        }
-        if (req.query.format === "chat") {
-            // Prefer PTY-derived structured messages, fall back to parsing raw output
-            const messages = snapshot.messages && snapshot.messages.length > 0
-                ? snapshot.messages
-                : parseMessages(snapshot.output);
-            res.json({ ...snapshot, messages });
-        }
-        else {
-            res.json(snapshot);
-        }
-    });
+    // ── Session control ──
     app.post("/api/commands", (req, res) => {
         const body = req.body;
         if (!body.command?.trim()) {
@@ -859,78 +787,101 @@ self.addEventListener('fetch', (event) => {
             res.status(201).json(snapshot);
         }
         catch (error) {
-            res.status(400).json({ error: getErrorMessage(error, "无法启动命令。请检查命令是否正确安装。") });
+            res.status(400).json({ error: getErrorMessage(error, "无法启动命令。请检查命令是否安装。") });
         }
     });
-    // Resume a session with a different mode (e.g., switch from terminal to chat)
     app.post("/api/sessions/:id/resume", (req, res) => {
         const sessionId = req.params.id;
         const body = req.body;
         try {
-            const existingSession = processes.get(sessionId);
+            const existingSession = processes.get(sessionId) || storage.getSession(sessionId);
             if (!existingSession) {
                 res.status(404).json({ error: "会话不存在。" });
                 return;
             }
-            if (existingSession.status !== "running") {
-                res.status(400).json({ error: "会话已结束，无法恢复。" });
-                return;
-            }
-            // Get the Claude session ID for resuming
             const claudeSessionId = existingSession.claudeSessionId;
             if (!claudeSessionId) {
                 res.status(400).json({ error: "此会话没有 Claude 会话 ID，无法恢复。" });
                 return;
             }
-            // Determine the new mode
-            const newMode = normalizeMode(body.mode, config.defaultMode);
-            // Build the resume command
-            const command = existingSession.command;
-            const isClaude = /^claude\b/.test(command);
-            if (!isClaude) {
+            const command = existingSession.command.trim();
+            if (!/^claude\b/.test(command)) {
                 res.status(400).json({ error: "只有 Claude 命令支持恢复功能。" });
                 return;
             }
-            // Create a new session with --resume flag
+            const newMode = body.mode
+                ? normalizeMode(body.mode, config.defaultMode)
+                : normalizeMode(existingSession.mode, config.defaultMode);
             const resumeCommand = `${command} --resume ${claudeSessionId}`;
-            const snapshot = processes.start(resumeCommand, existingSession.cwd, newMode, undefined);
-            // Copy the Claude session ID to the new session
-            // This is done internally by the process manager when it detects --resume
-            res.status(201).json(snapshot);
+            const newSnapshot = processes.start(resumeCommand, existingSession.cwd, newMode, undefined, { resumedFromSessionId: sessionId });
+            storage.saveSession({ ...existingSession, resumedToSessionId: newSnapshot.id });
+            res.status(201).json({ resumedFromSessionId: sessionId, ...newSnapshot });
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法恢复会话。") });
         }
     });
+    app.post("/api/claude-sessions/:claudeSessionId/resume", (req, res) => {
+        const claudeSessionId = String(req.params.claudeSessionId || "").trim();
+        const body = req.body;
+        try {
+            if (!claudeSessionId) {
+                res.status(400).json({ error: "Claude 会话 ID 不能为空。" });
+                return;
+            }
+            const existingSession = storage.getLatestSessionByClaudeSessionId(claudeSessionId);
+            if (existingSession) {
+                const command = existingSession.command.trim();
+                if (!/^claude\b/.test(command)) {
+                    res.status(400).json({ error: "只有 Claude 命令支持按 Claude Session ID 恢复。" });
+                    return;
+                }
+                if (!existingSession.cwd || !processes.hasClaudeSessionFile(existingSession.cwd, claudeSessionId)) {
+                    res.status(400).json({ error: "对应的 Claude 历史会话文件不存在，无法恢复。" });
+                    return;
+                }
+                const newMode = body.mode
+                    ? normalizeMode(body.mode, config.defaultMode)
+                    : normalizeMode(existingSession.mode, config.defaultMode);
+                const resumeCommand = `${command} --resume ${claudeSessionId}`;
+                const newSnapshot = processes.start(resumeCommand, existingSession.cwd, newMode, undefined, { resumedFromSessionId: existingSession.id });
+                storage.saveSession({ ...existingSession, resumedToSessionId: newSnapshot.id });
+                res.status(201).json({ resumedFromSessionId: existingSession.id, resumedClaudeSessionId: claudeSessionId, ...newSnapshot });
+            }
+            else {
+                // No existing wand session — resume directly with cwd from request body
+                const cwd = body.cwd?.trim();
+                if (!cwd) {
+                    res.status(400).json({ error: "未找到对应的会话记录，请提供工作目录 (cwd)。" });
+                    return;
+                }
+                const newMode = normalizeMode(body.mode, config.defaultMode);
+                const resumeCommand = `claude --resume ${claudeSessionId}`;
+                const newSnapshot = processes.start(resumeCommand, cwd, newMode);
+                res.status(201).json({ resumedClaudeSessionId: claudeSessionId, ...newSnapshot });
+            }
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "无法按 Claude 会话 ID 恢复会话。") });
+        }
+    });
     app.post("/api/sessions/:id/input", (req, res) => {
         const body = req.body;
         const sessionId = req.params.id;
         const input = body.input ?? "";
         const view = body.view;
-        console.error("[wand] Input request received", {
-            sessionId,
-            inputLength: input.length,
-            view: view ?? "chat"
-        });
+        console.error("[wand] Input request received", { sessionId, inputLength: input.length, view: view ?? "chat" });
         try {
             const snapshot = processes.sendInput(sessionId, input, view);
-            console.error("[wand] Input request succeeded", {
-                sessionId,
-                status: snapshot.status,
-                inputLength: input.length,
-                view: view ?? "chat"
-            });
+            console.error("[wand] Input request succeeded", { sessionId, status: snapshot.status, inputLength: input.length, view: view ?? "chat" });
             res.json(snapshot);
         }
         catch (error) {
             const response = getInputErrorResponse(error, sessionId);
             console.error("[wand] Input request failed", {
-                sessionId,
-                inputLength: input.length,
-                view: view ?? "chat",
-                responseStatus: response.statusCode,
-                responsePayload: response.payload,
-                error: getInputDebugMeta(error)
+                sessionId, inputLength: input.length, view: view ?? "chat",
+                responseStatus: response.statusCode, responsePayload: response.payload,
+                error: getInputDebugMeta(error),
             });
             res.status(response.statusCode).json(response.payload);
         }
@@ -947,8 +898,7 @@ self.addEventListener('fetch', (event) => {
     });
     app.post("/api/sessions/:id/approve-permission", (req, res) => {
         try {
-            const snapshot = processes.approvePermission(req.params.id);
-            res.json(snapshot);
+            res.json(processes.approvePermission(req.params.id));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法批准该授权请求。") });
@@ -956,8 +906,7 @@ self.addEventListener('fetch', (event) => {
     });
     app.post("/api/sessions/:id/deny-permission", (req, res) => {
         try {
-            const snapshot = processes.denyPermission(req.params.id);
-            res.json(snapshot);
+            res.json(processes.denyPermission(req.params.id));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法拒绝该授权请求。") });
@@ -967,8 +916,7 @@ self.addEventListener('fetch', (event) => {
         try {
             const { requestId } = req.params;
             const body = req.body;
-            const snapshot = processes.resolveEscalation(req.params.id, requestId, body.resolution);
-            res.json(snapshot);
+            res.json(processes.resolveEscalation(req.params.id, requestId, body.resolution));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法处理该授权请求。") });
@@ -976,8 +924,7 @@ self.addEventListener('fetch', (event) => {
     });
     app.post("/api/sessions/:id/stop", (req, res) => {
         try {
-            const snapshot = processes.stop(req.params.id);
-            res.json(snapshot);
+            res.json(processes.stop(req.params.id));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法停止会话。") });
@@ -992,8 +939,7 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "无法删除会话。") });
         }
     });
-    await processes.runStartupCommands();
-    // Create server (HTTP or HTTPS) - useHttps and protocol already defined above
+    // ── WebSocket broadcast layer ──
     const server = useHttps
         ? (() => {
             const ssl = ensureCertificates(resolveConfigDir(configPath));
@@ -1001,129 +947,13 @@ self.addEventListener('fetch', (event) => {
         })()
         : createHttpServer(app);
     const wss = new WebSocketServer({ server, path: "/ws" });
-    const wsClients = new Set();
-    const MAX_QUEUE_SIZE = 500; // Max messages in queue before applying backpressure
-    const OUTPUT_DEBOUNCE_MS = 50; // Debounce PTY output updates to reduce flicker
-    // Output debounce cache - batch rapid output events per session
-    const outputDebounceCache = new Map();
-    // Process send queue for a WebSocket client
-    function processWsQueue(client) {
-        if (client.sendInProgress || client.sendQueue.length === 0 || client.backpressurePaused) {
-            return;
-        }
-        client.sendInProgress = true;
-        const message = client.sendQueue.shift();
-        if (client.ws.readyState === WebSocket.OPEN) {
-            client.ws.send(message, (err) => {
-                client.sendInProgress = false;
-                if (err) {
-                    // Error sending, drop message
-                    return;
-                }
-                // Check backpressure threshold
-                const threshold = MAX_QUEUE_SIZE * 0.8;
-                if (client.backpressurePaused && client.sendQueue.length < threshold) {
-                    client.backpressurePaused = false;
-                }
-                // Continue processing queue
-                processWsQueue(client);
-            });
-        }
-        else {
-            client.sendInProgress = false;
-        }
-    }
-    // Broadcast process events to WebSocket clients with debouncing and backpressure control
+    const wsManager = new WsBroadcastManager(wss);
+    wsManager.setup((id) => processes.get(id));
+    // Wire process events to WebSocket broadcast
     processes.on("process", (event) => {
-        // Debounce output events to reduce flicker during rapid streaming
-        if (event.type === "output") {
-            const existing = outputDebounceCache.get(event.sessionId);
-            if (existing) {
-                clearTimeout(existing.timer);
-            }
-            const timer = setTimeout(() => {
-                outputDebounceCache.delete(event.sessionId);
-                broadcastEvent(event);
-            }, OUTPUT_DEBOUNCE_MS);
-            outputDebounceCache.set(event.sessionId, { event, timer });
-            return;
-        }
-        // Non-output events (started, ended, status) are sent immediately
-        broadcastEvent(event);
+        wsManager.emitEvent(event);
     });
-    function broadcastEvent(event) {
-        const message = JSON.stringify(event);
-        for (const client of wsClients) {
-            if (client.ws.readyState === WebSocket.OPEN) {
-                // Apply backpressure if queue is too large
-                if (client.sendQueue.length >= MAX_QUEUE_SIZE) {
-                    client.backpressurePaused = true;
-                    continue;
-                }
-                if (!client.backpressurePaused) {
-                    client.sendQueue.push(message);
-                    processWsQueue(client);
-                }
-            }
-        }
-    }
-    wss.on("connection", (ws, req) => {
-        const sessionToken = readSessionCookie(req);
-        if (!sessionToken || !validateSession(sessionToken)) {
-            ws.close(1008, "Unauthorized");
-            return;
-        }
-        const client = {
-            ws,
-            sendQueue: [],
-            sendInProgress: false,
-            backpressurePaused: false,
-            lastOutputBySession: new Map()
-        };
-        wsClients.add(client);
-        ws.on("close", () => {
-            wsClients.delete(client);
-        });
-        ws.on("error", () => {
-            // Already closed, ignore
-        });
-        ws.on("message", (data) => {
-            try {
-                const msg = JSON.parse(data.toString());
-                // Handle subscribe/unsubscribe for specific sessions
-                if (msg.type === "subscribe" && msg.sessionId) {
-                    // Client wants updates for a specific session
-                    const snapshot = processes.get(msg.sessionId);
-                    if (snapshot) {
-                        // Send full session snapshot including messages for reconnection recovery
-                        ws.send(JSON.stringify({
-                            type: "init",
-                            sessionId: msg.sessionId,
-                            data: {
-                                ...snapshot,
-                                // Ensure messages are included for chat mode recovery
-                                messages: snapshot.messages,
-                                // Include full output for terminal mode recovery
-                                output: snapshot.output
-                            }
-                        }));
-                    }
-                    else {
-                        // Session not found - might be deleted or never existed
-                        ws.send(JSON.stringify({
-                            type: "error",
-                            sessionId: msg.sessionId,
-                            error: "Session not found"
-                        }));
-                    }
-                }
-            }
-            catch {
-                // Ignore malformed messages
-            }
-        });
-    });
-    // Start server
+    // ── Start listening ──
     await new Promise((resolve, reject) => {
         server.listen(config.port, config.host, () => {
             const listenAddr = config.host === "0.0.0.0" ? "0.0.0.0 (所有接口)" : config.host;
@@ -1139,52 +969,9 @@ self.addEventListener('fetch', (event) => {
             reject(err);
         });
     });
-    // Print security warnings
     if (!storage.hasCustomPassword() && config.password === "change-me") {
         wandWarn("正在使用默认密码（change-me），任何能访问本机的人都可以登录。", "修改方法：在界面右上角「设置」中修改密码，或运行：node dist/cli.js config:set password <你的新密码>");
     }
-}
-function requireAuth(req, res, next) {
-    if (!validateSession(readSessionCookie(req))) {
-        res.status(401).json({ error: "未授权，请先登录。" });
-        return;
-    }
-    next();
-}
-function normalizeMode(input, fallback) {
-    return isExecutionMode(input) ? input : fallback;
-}
-function readSessionCookie(req) {
-    const cookie = req.headers.cookie;
-    if (!cookie) {
-        return undefined;
-    }
-    const match = cookie
-        .split(";")
-        .map((part) => part.trim())
-        .find((part) => part.startsWith("wand_session="));
-    return match?.slice("wand_session=".length);
-}
-async function listPathSuggestions(input, fallbackCwd) {
-    const normalizedInput = input.trim();
-    const baseInput = normalizedInput || fallbackCwd;
-    const resolvedInput = path.resolve(process.cwd(), baseInput);
-    const endsWithSeparator = /[\\/]$/.test(normalizedInput);
-    let searchDir = resolvedInput;
-    let partialName = "";
-    if (!endsWithSeparator) {
-        searchDir = path.dirname(resolvedInput);
-        partialName = path.basename(resolvedInput);
-    }
-    const entries = await readdir(searchDir, { withFileTypes: true });
-    return entries
-        .filter((entry) => entry.isDirectory())
-        .filter((entry) => !partialName || entry.name.toLowerCase().startsWith(partialName.toLowerCase()))
-        .sort((a, b) => a.name.localeCompare(b.name))
-        .slice(0, 8)
-        .map((entry) => ({
-        path: path.join(searchDir, entry.name),
-        name: entry.name,
-        isDirectory: true
-    }));
+    // Start configured background sessions after the server is already reachable.
+    processes.runStartupCommands();
 }